Sanu VargheseIT & AI notes
Tutorials › Microsoft 365 / Entra
IntermediateMicrosoft 365 / Entra · about 15 min · 19 October 2026

Review and switch off a third-party app in Entra ID

Third-party apps connected to Microsoft 365 can hold more power than your admins, and they sign in without MFA. Here's how to see what an app can do, check its sign-ins, and switch it off quickly if you need to.

Before you start

  • To review or change apps you need at least the Cloud Application Administrator role (Application Administrator also works).
  • To read sign-in logs you need at least the Reports Reader role.

Part 1: See what an app is allowed to do

  1. Go to entra.microsoft.com and sign in.
  2. In the left menu, open Entra ID > Enterprise apps > All applications. You'll see a list of every app with access to your tenant.
  3. Search for the app by name and select it.
  4. Select Permissions.
  5. Select the Admin consent tab. This shows permissions granted for the whole organisation. The User consent tab shows permissions individual users have granted.
  6. Select a permission to open the Permission Details pane and see what it allows. Names ending in ReadWrite.All mean the app can change data across the whole tenant.

Part 2: Check the app's sign-ins

  1. In the left menu, open Entra ID > Monitoring & health > Sign-in logs.
  2. Switch to Service principal sign-ins. App sign-ins are kept separately from user sign-ins, so they won't show on the default view.
  3. Set the date range to cover the period you're worried about, and filter to the app.
  4. Look at where sign-ins come from. Sign-ins from IP addresses that don't belong to the vendor, or that start suddenly, need investigating.

Part 3: Revoke a permission you don't want

Revoking a permission can stop the app working, for example a backup tool will stop backing up. Agree it with whoever relies on the app first, and note exactly what you removed.
  1. Go back to the app's Permissions page and stay on the Admin consent tab.
  2. Select the ... next to the permission.
  3. Select Revoke permission.
You can't revoke permissions on the User consent tab in the portal. Microsoft says to use Microsoft Graph or PowerShell for those. Revoking also doesn't stop someone consenting again, so check your user consent settings too.

Part 4: Switch the app off completely

This blocks the app for everyone in the tenant. Anything that depends on it will stop working.
  1. Open Entra ID > Enterprise apps > All applications and select the app.
  2. Select Properties.
  3. Next to Enabled for users to sign-in?, select No.
  4. Select Save.

Microsoft says this stops any tokens being issued for the app in your tenant. Tokens issued before you made the change can keep working until they expire, so keep watching the sign-in logs afterwards.

If the app doesn't appear in the list, you can disable it by its application ID with Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "Application.ReadWrite.All"
$appId = "{AppId}"
$sp = Get-MgServicePrincipal -Filter "appId eq '$appId'"
Update-MgServicePrincipal -ServicePrincipalId $sp.Id -AccountEnabled:$false

Replace {AppId} with the app's Application ID, which you'll find on the app's Overview page.

Check it worked

  • Open the app's Properties again. Enabled for users to sign-in? should show No.
  • On the Permissions page, any permission you revoked should no longer be listed on the Admin consent tab.
  • Check Service principal sign-ins again later. New sign-ins from the app should fail or stop appearing.

Sources

← All tutorials
Esc